Atlas / MCP servers / yonaka15 / Redmine

RedmineSAFE

Name: Redmine
Author: yonaka15

mcp/yonaka15/redmine-1

MCP server by yonaka15 · Audited 2026-10-07

⚑ Report / re-scan Source ↗

MCP server for Redmine

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

26 11r · 10w · 5d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://smithery.ai/server/@yonaka15/mcp-server-redmine)

This is a Model Context Protocol (MCP) server implementation for Redmine. It integrates with Redmine's REST API to provide ticket and project information to LLMs.

Features

Supports stable resources from Redmine REST API:

Issues (1.0~)
Projects (1.0~)
Users (1.1~)
Time Entries (1.1~)

Tools

Issues

Search Issues
Filter by project, status, assignee, etc.
Keyword search
Custom field support
Create/Update Issues
Set tracker, status, priority
Configure custom fields
Add comments
Delete Issues

Projects

Search Projects
Filter by active/archived/closed status
Keyword search
Get Project Details
Include trackers, categories information
Create/Update Projects
Configure modules and trackers
Set member inheritance
Archive/Unarchive Projects
Delete Projects

Time Entries

Search Time Entries
Filter by project, user, date range
Get Time Entry Details
Create/Update Time Entries
Record against project or issue
Specify activity
Custom field support
Delete Time Entries

Usage with Claude

To use this server with Claude, configure it as follows:

{
"mcp-server-redmine": {
"command": "npx",
"args": [
"-y",
"--prefix",
"/path/to/mcp-server-redmine",
"mcp-server-redmine"
],
"env": {
"REDMINE_HOST": "https://your-redmine.example.com",
"REDMINE_API_KEY": "your-api-key-here"
}
}
}

Configuration Options

command: Command to execute the npm package
args:
-y: Auto-respond "yes" to prompts
--prefix: Specify installation directory
Last argument specifies

Read from source at commit daf223bef3a4OBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mcp-server-redmine --env REDMINE_API_KEY=${REDMINE_API_KEY} -- npx -y @yonaka15/[email protected]

claude-desktop

{
  "mcpServers": {
    "mcp-server-redmine": {
      "command": "npx",
      "args": [
        "-y",
        "@yonaka15/[email protected]"
      ],
      "env": {
        "REDMINE_API_KEY": "${REDMINE_API_KEY}"
      }
    }
  }
}

Exposed tools (26)

11 read · 10 write · 5 destructive. Blast radius: 5 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add_issue_watcher`	write	Add a user as watcher to an issue.
`archive_project`	read	Archive a project.
`create_issue`	write	Create a new issue.
`create_project`	write	Create a new project.
`create_time_entry_for_issue`	write	Record spent time on an issue.
`create_time_entry_for_project`	write	Record spent time on a project.
`create_user`	write	Create a new user account.
`delete_issue`	destructive	Delete an issue permanently.
`delete_project`	destructive	Delete project permanently.
`delete_time_entry`	destructive	Delete a time record permanently.
`delete_user`	destructive	Delete a user permanently.
`get_issue`	read	Get a specific issue by its ID.
`list_issues`	read	List and search Redmine issues.
`list_project_statuses`	read	指定されたRedmineプロジェクトの特定のトラッカーで利用可能なIssueステータスの一覧を取得
`list_projects`	read	List all accessible projects.
`list_time_entries`	read	List and search logged time records.
`list_users`	read	List all users in the system.
`remove_issue_watcher`	destructive	Remove a user from issue watchers.
`show_project`	read	Get detailed project information.
`show_time_entry`	read	Get details of a time record.
`show_user`	read	Get details of a specific user.
`unarchive_project`	read	Restore an archived project.
`update_issue`	write	Update an existing issue.
`update_project`	write	Update project settings.
`update_time_entry`	write	Update an existing time record.
`update_user`	write	Update an existing user.

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (1 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (7)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_issue, delete_project, delete_time_entry, delete_user, remove_issue_watcher

Why it matters. 5 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius